rewrite this content and keep HTML tags as is:
More than 2,000 years ago, Chinese military strategist Sun Tzu observed: “If you know the enemy and know yourself, you need not fear the result of a hundred battles.”
His advice remains relevant as geopolitical tensions and cyber threats raise questions about business resilience across the Gulf.
Much of the discussion focuses on the changing nature of cyber threats and how organisations can defend themselves. But understanding the enemy is only half the challenge. Businesses must also understand their own vulnerabilities and the potential operational and financial consequences of an attack.
According to the UAE Cyber Security Council, 128 confirmed cyber threat incidents targeted entities across the country between the start of 2026 and February 18, including ransomware attacks, government breaches and data leaks.
Meanwhile, cybersecurity company Kaspersky says it detected and blocked more than 50 million web and local threats across the GCC in the first eight months of 2025. Password-stealer detections rose 21 percent and spyware attacks increased 34 percent.
These figures underline the importance of cybersecurity, but also raise a broader question: how should businesses decide where to invest?
A significant part of my career has been in risk management, and I’ve seen how seriously financial institutions approach this challenge.
Banks routinely stress-test their businesses against difficult circumstances, from economic downturns to financial shocks. They assess how scenarios may affect their balance sheets, evaluate existing protections and determine what additional measures may be needed.
Gulf businesses can benefit from applying the same financial discipline to cyber risk.
Some investment is undoubtedly necessary, but spending more is not always the answer
Recent events have made this particularly relevant. Physical attacks on Amazon Web Services data centres in the UAE and Bahrain in March disrupted cloud services, demonstrating how damage to critical infrastructure can affect dependent businesses.
The consequences have proved lasting. In September, AWS said it could not restore access to resources and data hosted exclusively in its Bahrain cloud region or in one of its three UAE availability zones.
Although these were physical rather than cyber attacks, they exposed a fundamental vulnerability: organisations can suffer serious technological and financial disruption without being directly targeted.
The cyberattack on Jaguar Land Rover in 2025 offers another example. Production halted for around five weeks, with consequences reaching suppliers, dealerships and other businesses. The UK’s Cyber Monitoring Centre estimated the wider economic impact at £1.9 billion ($2.5 billion), affecting more than 5,000 organisations.
The financial consequences of disruption can extend far beyond the initial incident.
Focus on the consequences
So, what should businesses do differently?
Start by looking beyond cybersecurity. Business leaders should focus on the consequences of an attack, particularly its operational and financial implications.
Take a large manufacturer. What does a week without production mean financially? What if the shutdown lasts a month? Will customers go elsewhere? Can the business continue meeting its obligations?
The answers can clarify how risk is understood and managed within the organisation.
Businesses should use scenario analysis to identify events that can cause serious operational or financial harm, assess how they may unfold and estimate potential losses.
These estimates need not be precise. Their purpose is to establish the potential scale of damage and help organisations make better decisions about managing it.
The real value lies in the decisions that follow.
Businesses are constantly being asked to spend more on cybersecurity. In Saudi Arabia, spending on cybersecurity products and services reached SAR15.2 billion ($4.1 billion) in 2024, up 14 percent from the previous year, according to the National Cybersecurity Authority.
Some investment is undoubtedly necessary, but spending more is not always the answer.
Organisations must balance investing in capabilities that prevent attacks with those that help them recover faster. Decisions should be informed by how effectively each investment reduces potential financial losses.
Further reading:
Further reading:
For example, a business may discover that improving its ability to restore critical systems reduces potential losses more effectively than additional preventative measures alone.
This approach also changes the conversation about insurance.
Rather than buying cover based primarily on market availability, businesses can consider what losses they can reasonably absorb, what they prefer to insure and whether existing policies provide the protection they expect.
Perhaps most importantly, it changes the boardroom conversation.
Cyber risk is too often discussed in terms of threats, vulnerabilities and technology. These matter, but chief executives and finance directors also need to understand what a serious incident means for revenue, profitability and the company’s ability to operate.
Banks have long understood that preparing for difficult circumstances requires making judgements about events that may never happen. Not every possibility can be anticipated, and not every loss avoided. The objective is to make informed decisions before those decisions are forced upon you.
As Gulf economies diversify and businesses become more digitally connected, this discipline will become increasingly important.
When businesses understand what a serious cyber incident may cost them, cybersecurity stops being simply a technology expense and becomes a question of financial resilience.
Sid Wahi is head of cyber risk advisory at Gallagher
